CVE-2026-105134Vulnerability

1. “CVE-2026-105134”

   CERT-FRGovernment19 Oct 2026
   Bulletin d'actualité CERTFR-2026-ACT-044 (19 octobre 2026)

2. “CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability”

   Security AffairsNews15 Oct 2026
   U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

3. “CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS”

   Help Net SecurityNews15 Oct 2026
   CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

4. “The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.”

   The Hacker NewsNews15 Oct 2026
   AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

5. “CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities”

   Horizon3.aiVendor15 Oct 2026
   CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities

6. “CVE-2026-105134 – A file write path traversal leading to remote code execution”

   Horizon3.aiVendor14 Oct 2026
   AhsayCBS Deep-Dive: Auth Bypass to RCE

7. “De kwetsbaarheid met kenmerk CVE-2026-105134 heeft een CVSS-score van 10,0 en betreft OS-command-injectie in de Replication Receiver via /rps/api/json/UpdateReceivers.do.”

   NCSC-NL advisoriesGovernment14 Oct 2026
   NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBS

8. “CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability”

   CISA advisoriesGovernment14 Oct 2026
   CISA Adds Four Known Exploited Vulnerabilities to Catalog

9. “…-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOffice), and multip…”

   The Hacker NewsNews12 Oct 2026
   ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

10. “CVE-2026-105134 (CVSS v4 score: 9.3) - An operating system command injection vulnerability in the Replication Receiver component.”

    The Hacker NewsNews9 Oct 2026
    Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

11. “Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.”

    SecurityWeekNews9 Oct 2026
    Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

12. “On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134.”

    HuntressVendor8 Oct 2026
    Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

• updatereceivers[.]doin 5 reports
• apistructsaction[.]javain 2 reports
• fbijobs[.]govin 1 report
• 177.4.12[.]11in 1 report

Also named with it: CVE-2026-105133, CVE-2026-76519, CVE-2026-0322, CVE-2026-102489, CVE-2026-102490, CVE-2026-96940, CVE-2026-59265, CVE-2026-63277, CVE-2026-21589, CVE-2026-86360, CVE-2026-86361, CVE-2026-86362, CVE-2026-91140, CVE-2026-102255, CVE-2026-106197, CVE-2026-106358